Low: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2018-5133

If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads "chrome://browser/content/preferences/in-content/preferences.xul" directly in a tab and executes a search. This...

CVE-2018-5133

CVE-2018-5133 affects Firefox before 59, where a malicious local program can set the app.support.baseURL preference to HTML/script, which is not sanitized and can execute when loading chrome://browser/content/preferences/in-content/preferences.xul or when an EME CDM-disabled notification is shown...

modeshutters.com.au XSS vulnerability

Vulnerable URL: http://modeshutters.com.au/svcore/full.html?bg="=http://modeshutters.com.au/gallery3/gallery.xml=http://modeshutters.com.au/gallery3/=http://modeshutters.com.au/gallery3/images/=http://modeshutters.com.au/gallery3/thumbs/=true=true=false=true=true=true=fff=fff=true=-1=Awnings...

Adobe Flash Player 8.0.34.0/9.0.x main.swf baseurl Parameter asfunction: Protocol Handler XSS

No description provided by source. source: http://www.securityfocus.com/bid/26949/info Adobe Flash Player is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code i...

CVE-2009-1606: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control DafoloFFControl.dll 1.108.6.195 allow remote attackers to execute arbitrary code via long 1 baseurl, 2 kommune, 3 felter, 4 afdeling, 5 Flags, 6 HelpURL, 7 caburl, or 8 filename properties; or 9 a long...

CVE-2008-1116

Insecure method vulnerability in the Web Scan Object ActiveX control OL2005.dll in Rising Antivirus Online Scanner allows remote attackers to force the download and execution of arbitrary code by setting the BaseURL property and invoking the UpdateEngine method. NOTE: some of these details are...

Design/Logic Flaw

Insecure method vulnerability in the Web Scan Object ActiveX control OL2005.dll in Rising Antivirus Online Scanner allows remote attackers to force the download and execution of arbitrary code by setting the BaseURL property and invoking the UpdateEngine method. NOTE: some of these details are...

CVE-2008-1116: Undefined Security Weakness

Insecure method vulnerability in the Web Scan Object ActiveX control OL2005.dll in Rising Antivirus Online Scanner allows remote attackers to force the download and execution of arbitrary code by setting the BaseURL property and invoking the UpdateEngine method. NOTE: some of these details are...

CVE-2006-6197: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in b2evolution 1.8.2 through 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the 1 appname parameter in a 404notfound.page.php, b 410statsgone.page.php, and c refererspam.page.php in inc/VIEW/errors/; the 2 baseurl...

TYPO3 Security Bulletin

Under special circumstances, setting config.baseURL see typo3.org/documentation/document-library/doccoretsref/quotCONFIGquot/ to a numeric value "1" could be used to spoof a malicious baseURL into your TYPO3 cache. It has now been decided to technically prevent this misconfiguration. Component...

CVE-2004-1153: Undefined Security Weakness

Format string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via an .ETD document containing format string specifiers in 1 title or 2 baseurl fields...